Legal
Security and data
Last updated
This page summarises how Rune protects the data you put into it. It is written for IT, security and procurement teams reviewing Rune before a programme sends staff a questionnaire link. If you need more detail, or a completed security questionnaire, email info@runehq.co.uk.
At a glance
| Provider | Select Red Ltd, England and Wales |
| Hosting | Clook Internet (sub6 Limited), UK data centres |
| Encryption in transit | HTTPS (TLS) everywhere; plain HTTP redirects to HTTPS |
| Payments | Stripe; Rune never sees or stores card numbers |
| Respondent accounts | None needed; respondents never create an account |
| Respondent email addresses | Not collected or stored by Rune |
| Individual answers | Never shown to anyone, including the customer |
| Cookies | One strictly necessary sign-in cookie in the app; none on the website |
| Data processing terms | Included in our terms of service, section 11 |
Anonymity, by design
Rune is built to help teams rather than rank them, and that starts with how answers are shown:
- Individual answers are never shown. Customers see each team's or process's combined score and how far people agreed, never who gave which answer.
- A minimum of three responses before any score for a team or process appears, and five before the spread between the lowest and highest answer is shown. Below that, the screen says how many have answered so far.
- No league tables. Teams and processes are listed by name, never ranked by score.
- Blockers describe obstacles, not people.
Access control
- Workspaces are isolated. Every record belongs to one workspace, and every request is checked against the signed-in user's workspace, so one customer can never see another's data.
- Respondent links and embeds use their own long random codes, which grant access only to that one questionnaire or view. A customer can remove a link or revoke an embed at any time.
- Our own administrators see account details and usage counts (for example how many responses a workspace has), but not questionnaire answers, comments or blockers.
Passwords and sessions
- Passwords are stored only as salted hashes, using PHP's standard password hashing, and must be at least 10 characters.
- Sign-in sessions use a random token in a secure, HTTP-only cookie. Only a hash of the token is stored, and sessions expire after 8 hours.
- Password reset links are single-use, expire after one hour, and resetting a password signs the account out everywhere else. The reset form never reveals whether an email address has an account.
Application security
- Uploaded logos are served with a restrictive content security policy, so they cannot run scripts.
- Rune's code, configuration and database files cannot be reached from the web.
- Our Stripe access key is restricted to the few actions Rune needs. It cannot refund payments, move money or change the account.
- Rune runs on PHP 8 and MySQL with no third-party code libraries on the server, which keeps the attack surface small.
- Jira and Azure DevOps connections are optional and set per engagement. The API token is encrypted at rest (AES-256-GCM), is never shown again or sent to the browser, and is used only to create the work items you send and read back their status. Rune only connects to Jira Cloud (
*.atlassian.net) and Azure DevOps (dev.azure.com) addresses.
Data location, retention and deletion
- Data is held by our hosting provider in the United Kingdom. Payment data is held by Stripe.
- A workspace owner can delete the workspace and all its content at any time (Settings → Delete workspace). It is removed from the live service immediately. Copies in backups are overwritten in the hosting provider's normal backup cycle.
- After a trial ends or a subscription is cancelled, data is kept for 12 months so customers can come back, then deleted.
- Full details are in our privacy policy.
Backups and availability
Our hosting provider, Clook Internet, backs up the database and files daily within the United Kingdom, and older backups are overwritten in a regular cycle. Customers can also export their results at any time.
Incidents
If we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know and what we are doing about it.
Reporting a security issue
If you think you have found a security problem in Rune, please email info@runehq.co.uk with details. Please give us reasonable time to fix it before telling anyone else.
Questions about this page: info@runehq.co.uk. See also Privacy · Terms · Security and data.